jaas+krb5 vs krb5 backed password authentication

[Cantor, Scott]

On 3/27/19, 1:40 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> Is the JAAS configuration that actually authenticated the user available to shibboleth somehow outside of the
> authentication event itself?  Maybe in the subject?

The product of JAAS authentication is a "Subject", which is a bunch of collections of objects, primarily Principal subtypes, also some public and private "credential" objects that are module specific. The IdP makes use of the Principal objects in some cases along with supplementing its own (e.g. UsernamePrincipal), and has serialization machinery for the Principal types it knows about along with pluggability to serialize types it doesn't know about for specialized deployments.

The IdP is built around the Subject and Principal abstraction to represent authentication results because it's already there in Java and anything else would be just as much a pain to deal with for handling extensibility.

I don't know if that's what you're asking.

-- Scott